MatrikonOPC OPC Exchange

Risky Business?

Posted on April 18th, 2007 by Eric Murphy

OPC Security is making news again with the ominously titled article “New study reveals OPC Usage May be Putting Major Industries at Risk”.    It talks about how some companies are using OPC in mission critical applications, are allowing access from potentially insecure networks and don’t understand how to secure OPC properly.    Walt gave a heads up on the article on his shiny new SOUND OFF! Blog, now with the ever popular RSS Feed!   (In the words of Audrey II, Feed me, Feed me Seymour!)

The article is very well done, as you would expect based on the responsible work that Eric Byres and Dale Peterson have done on raising awareness on security in SCADA applications, including OPC.   The article is basically an expanded version the abstract of the first of three whitepapers on OPC Security.   

    Some of the key statements include:         

  • “Many in the industry believe that OPC is just used for data management purposes on the plant floor and isn’t all that vital. The survey results contradict this myth, showing that OPC is a critical component of many production systems.”
  • “Approximately 20% of the companies reported deploying OPC over the site business networks and corporate Intranets and 12% used OPC over the Internet, most without encryption”
  • “Securely deploying OPC applications has proven to be a challenge for most engineers and technicians.”
  • “All things considered, there is little doubt that some clear advice for the control engineer on how best to secure OPC systems would be very useful.”

The main thrust of the article is that OPC is widely used, methods for securing SCADA and OPC architectures are not well understood and there are those that have not deployed their systems correctly and it could lead to serious consequences.   It is inevitable that there will be those that will get a different message from that which I believe the authors intended.   (In some cases, I’m sure there will be those that will deliberately interpret it differently for their own benefits).  I’d like to take this chance to point out some of the things I see could get lost in translation, or specifically what the article does NOT say:

  • It does NOT say OPC is risky, flawed, vulnerable or should not be used for industrial applications.  It says that IT administrators and control systems engineers/technicians should be aware of, and understand the security ramifications of their OPC deployments.
  • It does NOT say OPC should never be used in mission critical applications.  It says OPC was not designed with level of criticality in mind.  This is true, since things like inherent security or encryption are not part of the specification.  If OPC is going used in these types of applications, the users need to make design considerations for such things as security, redundancy, deterministic failure modes, encryption, monitoring/auditing etc.
  • It does NOT say all OPC applications are not secure.  It says there are a significant number of systems that have been deployed without security in mind, and that the dubious protection historically offered from ‘security by obscurity’ is rapidly disappearing.   (Not that it was ever a valid precaution method to begin with).   Securing any critical infrastructure requires understanding and clear guidelines.Deploying any mission critical system, or exposing an industrial network to uncontrolled environments via the internet, without adequate understanding or security measures in place creates unacceptable risk.   This is true of OPC networks, and any other SCADA network that in not inherently secure, Modbus, DDE, BACnet, Et cetera, Ad infinitum.Bottom line is if you are deploying OPC systems that can affect your control systems, you should be talking with a responsible OPC vendor and taking appropriate security measures including:
  • Proper DCOM configuration, considering OPC Tunnelling and patching your systems regularly.  
  • The first part of the OPC Security Whitepaper gives some background on OPC and how it is deployed.   I’m looking forward to seeing the final versions of Parts 2 and 3 as well.

    • Posted in OPC Industrial Connectivity |

    Leave a Reply

    For spam filtering purposes, please copy the number 2273 to the field below: